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We demonstrate that secure communication using coherent states is possible. The optimal eaves- 
dropping strategy for an M-ry ciphering scheme shows that the minimum probability of error in a 
measurement for bit determination can be made arbitrarily close to the pure guessing value P e = 1 /2. 
This ciphering scheme can be optically amplified without degrading the security level. New avenues 
are open to secure communications at high speeds in fiber-optic or free-space channels. 



Secure communication protocols protected by physical 
laws instead of mathematical complexities, such as the 
BB84 quantum protocol for key distribution, seem to 
have encountered a bottle-neck that hampers their uti- 
lization in real networks. The same no-cloning theorem 
that guarantees security forbids signal amplification nec- 
essary in long-haul communication links. No alternate 
quantum scheme using quantum repeaters or entangled 
states, having practical applicability within a reason- 
able time span, has been envisaged. The question "is 
it possible to create a system with available technology 
that could provide unconditional security in long distance 
communication?" has a positive answer. It relies on the 
use of quantum noise inherent in the coherent states of 
light, as demonstrated in this paper. 

In the presence of noise, it has been shown informa- 
tion theoretically 2] that new shared secret keys can be 
created between two users. A specific protocol has been 
proposed by Yuen, (3, which has been called the YK 
protocol. A particular implementation of this YK proto- 
col has been demonstrated,^ in which detector noise is 
utilized and hence it is not unconditionally secure. How- 
ever, the YK protocol can be made unconditionally se- 
cure by utilizing the fundamental, unavoidable quantum 
noise in a quantum signaling scheme. The other known 
secure scheme is, of course, the BB84,0 or its variant 
that involves features of B92,Q where coherent states 
instead of Fock states are employed. The implementa- 
tions of the YK protocol, and BB84, both suffer from 
the intrinsic limitation that very weak signals with no 
more than one photon per mode have to be used, mak- 
ing them severely rate-limited in a lossy channel. This 
problem can be alleviated in a new protocol, where meso- 
scopic coherent states are employed to overcome loss and 
to allow ordinary amplification, switching and routing. 
In addition to the use of the fundamentally-unavoidable 
quantum noise in coherent states, a crucial new ingredi- 
ent in this protocol is the explicit use of a shared secret 



key for the cryptographic objective of key expansion. A 
shared secret key is also needed in the BB84 and the YK 
protocols for the purpose of user and message authenti- 
cation amidst the protocol execution. 

In the ciphering scheme for this new protocol the 
sender (Alice) uses an explicit secret key (a short key 
K, appropriately expanded into a longer key K' by use 
of another encryption mechanism such as a stream ci- 
pher) to modulate the parameters of, in general, a mul- 
timode coherent state. Coherent states span an infinite 
dimensional Hilbert space which we refer to as a qumode. 
A qumode can be associated with any physical property 
of light such as polarization, phase, frequency or time. 
For the free-space implementation to be presented, the 
qumodes are the two orthogonal modes of polarization. 
In this case, Alice uses the running key K' to specify 
a polarization basis from a set of M uniformly spaced 
two-mode bases spanning a great circle on the Poincare 
sphere. Each basis consists of a polarization state and 
its antipodal state at an angle ir from it, representing 
the and 1 bit value for that basis. The message X is 
encoded as Yk' (X) . This mapping of the stream of bits 
onto points of the Poincare sphere is the key to be shared 
by Alice and the receiver (Bob). Because of his knowl- 
edge of K', Bob is able to make a precise demodulation 
operation producing the plaintext X. Bob applies K' to 
the received sequence of arbitrary polarization states to 
return them to the linearly orthogonally polarized con- 
dition, representing the two original bits of the message 
X. 

We present analysis that covers both polarization as 
well as phase modulation of optical signals. In the case 
of polarization states, information is encrypted and en- 
coded on two orthogonal polarization modes of radiation 
with annihilation operators a\ and a-i- A coherent state 
IV'o) with amplitude a in mode ai (|^o) — |0) ® \ a )) is 
"rotated" by a unitary transformation U Vb (</?& = or ir) 
to create the bit of a message. This rotation is performed 
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by, e.g., U Vb = exp{(<p b /2)(a\a 2 - ai<4)L 



= ® |a) = |asin^) O |acos^). (1) 

For phase encoding within a given polarization state, one 
could start by splitting a coherent state \a) into a two- 
mode coherent state \^f ) = |a/\/2)i <8 \a/^/2) 2 . Bit 
encoding can be represented by the operation 
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where J z = (ajai — a2<22)/2. Demonstration of the se- 
curity of the ciphering scheme in both kinds of physical 
encoding, polarization or phase, can be treated with the 
same formalism and leads to the same result. 

Let us analyze the phase ciphering, applied by the same 
modulator generating the bit sequence. The ciphering 
angle </>„ could have v as a discrete or a continuous vari- 
able determined by some general distribution. A ciphered 
two-mode state is |* 6 „) = e - i "Mvt,+<M |^ ) an d the cor- 
responding density operator for all possible choices of v 
is pb- The problem is to find the minimum probability of 
error Pf that an eavesdropper (Eve) can achieve in bit 
determination, given that ciphered states are used. 

No restriction is imposed on the physical devices avail- 
able to Eve, including perfect detectors and unlimited 
computational power. A close-to-source attack is consid- 
ered, where no losses have yet occurred that normally 
would during propagation of the signal. These are the 
ideal conditions for an eavesdropper. 

The optimal POVM for discriminating between po 
and p\ is given by Helstrom's binary discrimination 
procedure |9j applied to Ap = p\ — po. Calling I±i and IIo 
(III + n = I) the projectors over eigenstates with the 
positive and negative eigenvalues of Ap, the probability 
of error P? is 



Pf = Tr [pillopi +poIIipo] , 



(3) 



where pi and po are a-priori probabilities to find a state 
in pi or po, respectively. In one of Yuen's scheme, 
closest values of a given k are associated with distinct 
bits from the bit at position k. For example, <pk = 
7r [k/M+ (1/2) (1 - (-l) fc )] , k = 0,1,...,M-1. In this 
encoding protocol, two closest neighboring states repre- 
sent distinct bits. Figure^shows the minimum probabil- 
ity of error as a function of the number of ciphering levels 
M. Pf goes very fast to the asymptotic pure-guessing 
limit of 1/2 as M increases. The quantum noise present 
in the coherent state of light is what turns these states 
indistinguishable to an eavesdropper. 

Bob, on the other hand, by knowing the key has a 
more complete information on the state of light sent and 
can extract the information with great precision. His 
probability of error is 
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FIG. 1: Pf as a function of M for \a\ 2 = 1, 10, 100, 100. 

For sufficiently large values of a the minimum probability 
of error P^ is negligible, leading to an excellent signal 
recovery by Bob. 

Note that the present analysis does not include Eve's 
attacks using trial keys, which would be exponentially 
complex. Also, the stream cipher output in the system is 
not open to observation, thus its seed key is not open to 
the usual known plaintext attacks. The complete security 
analysis for the most general attacks would be presented 
elsewhere. 

This scheme opens up the path for long-distance secure 
communication based on protection by physical laws in- 
stead of mathematical complexities. 
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